Cross site request forgery (csrf)

The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation with the none role via a request for variants...